Mistic Self-Destructing In-Memory Backdoor (MLTBackdoor) Deployed by KongTuke Access Broker Enabling Multi-Group Ransomware Intrusions

Mistic Self-Destructing In-Memory Backdoor (MLTBackdoor) (TL-2026-0967), also tracked as MLTBackdoor, is a high-severity malware campaign, first published 2026-06-28. It is attributed to KongTuke with medium confidence, affects Microsoft Windows, maps to 41 MITRE ATT&CK techniques (T1003, T1005, T1008), and is covered by 9 detection rules and 46 indicators of compromise.

Key facts for TL-2026-0967

Threat ID
TL-2026-0967
Also known as
MLTBackdoor, Backdoor.Mistic, Win64.Backdoor.MLTBackdoor, KongTuke Campaign, Woodgnat Campaign, CrashFix Campaign
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-06-28
Last reviewed
2026-06-28
Attribution
KongTuke
Attribution confidence
MEDIUM
Motivation
FINANCIAL
Target sectors
insurance, education, it-services, professional-services, enterprise
Target regions
North America, Europe
Detection rules
9
Indicators of compromise
46

Malware and tooling in Mistic Self-Destructing In-Memory Backdoor (MLTBackdoor)

Malware and tooling: Mistic, BOF (Beacon Object File) runtime, MLTBackdoor, ModeloRAT

Mistic (tracked as MLTBackdoor by Zscaler ThreatLabz) is a sophisticated in-memory Windows backdoor active since April 2026, delivered via ClickFix/FileFix social-engineering chains and DLL side-loading using the legitimate signed Microsoft Defender binary MpExtMs.exe. The KongTuke initial access broker (also known as Woodgnat/TAG-124) deploys Mistic alongside the Python-based ModeloRAT to profile corporate environments, then sells persistent footholds to ransomware affiliates including Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta. Targeted sectors include insurance, education, IT services, and professional services across North America and Europe.

How Mistic Self-Destructing In-Memory Backdoor (MLTBackdoor) works

Mistic (Symantec designation: Backdoor.Mistic; Zscaler designation: Win64.Backdoor.MLTBackdoor) is a highly evasive Windows backdoor first observed in April 2026 by Symantec Threat Hunter Team, with coordinated public disclosure by both Symantec/Broadcom and Zscaler ThreatLabz on June 25, 2026. The malware is attributed to KongTuke, a financially motivated initial access broker (IAB) also tracked as Woodgnat, TAG-124, 404 TDS, Chaya_002, and LandUpdate808 — active since at least May 2024.

The KongTuke infection chain relies on three primary lure mechanisms: ClickFix (fake browser errors on compromised WordPress pages), FileFix (malicious file-open prompts), and CrashFix (a malicious NexShield browser extension that intentionally crashes Chrome then presents a fake fix). In the Teams-based vector, attackers use spoofed Microsoft 365 tenants (e.g., officeupdates366.onmicrosoft.com) with Unicode display-name spoofing to impersonate IT help desks and convince victims to execute PowerShell commands. Web-based lures direct victims to paste a conhost.exe/curl command into the Windows Run dialog, downloading a compressed archive from an attacker C2.

The delivery archive contains data.bin (RC4-encrypted MLTBackdoor payload) and endpointdlp.dll (the stage-one loader). The loader decrypts the payload using a 32-byte RC4 key embedded in the payload header, then initiates DLL side-loading: the legitimate signed Microsoft binary MpExtMs.exe is placed in the working directory alongside a malicious version.dll (which hooks GetModuleFileNameW and LoadLibraryW) to load the Mistic payload (EndpointDlp.dll). This masquerades as Microsoft Endpoint Data Loss Prevention tooling. A self-update mechanism pulls from powwowski.com/payloads/update.zip. Mistic operates entirely in memory — it writes no persistent files — and includes a kill-switch command (message type 4: Exit process) that self-terminates and deletes all components from disk, enabling seamless access handoff to ransomware purchasers.

Mistic's C2 protocol uses TLS on port 443 with the endpoint path /api/v1/telemetry and blends in using the User-Agent string 'Microsoft-Delivery-Optimization/10.1'. Key exchange uses ECDH on NIST P-256; session payloads are AES-256-GCM encrypted with a random 12-byte nonce per message. Every packet carries a 4-byte magic header (0x014D4C54 = '\x01MLT'). Supported commands include file upload/download/move/delete/mkdir/list, polling frequency adjustment, in-memory BOF (Beacon Object File) execution, and self-termination. A date-based DGA (LCG with multiplier 0x0019660D and increment 0x3C6EF35F, seeded by YYYYMMDD) generates one new .com domain per day as a fallback C2.

Obfuscation is sophisticated and multi-layered: Mixed Boolean-Arithmetic (MBA) rewrites arithmetic operations into multi-step bitwise equivalents producing ~95% junk code; Control Flow Flattening (CFF) replaces all conditionals with while(1)/switch(state) dispatch loops with XOR-obscured state values; strings are constructed byte-by-byte at runtime across flattened state machines; Windows APIs are resolved at runtime by DJB2 hash (e.g., WinHttpConnect → 0x7242C17D); and 31 NT syscalls are dispatched via a Hell's Gate-style indirect syscall table. Anti-analysis uses a 10-bit bitmask checking hypervisor presence (VMware/VBox/Xen/KVM), timing (RDTSC+CPUID loops), debugger (NtQueryInformationProcess), SHA256 hashes of running analysis-tool processes, window titles, driver names, RAM size (<2GB), CPU count (single-core), and system uptime (<5 minutes).

KongTuke also deploys ModeloRAT, a Python-based RAT using portable WinPython (WPy64-31401) deployed to %APPDATA%\Roaming. ModeloRAT's Pmanager.py uses RC4+zlib over HTTP:80 with a five-server failover C2 pool, beaconing every 300 seconds. It creates four redundant persistence mechanisms: a Registry Run Key (MonitoringService), a Startup folder LNK shortcut (StartManagerB.lnk), a VBScript launcher (scriptA.vbs), and a SYSTEM-level scheduled task named ChromeA or AdobeA. The collector module (collector.py) profiles domain-joined status, runs net.exe/PowerShell LDAP enumeration of AD users/groups/computers, enumerates running processes/services/AV via WMI SecurityCenter2, and dumps results to configA.json. A credential harvesting module (f.dll) displays a fake Windows login screen; an escalation module (n.dll) handles privilege elevation. The CrashFix campaign adds a malicious NexShield Chrome extension (ID: cpcdkmjddocikjdkbbeiaafnpdbdafmi) that iterates 1e9 Chrome runtime port connections to deliberately crash the browser, then delivers a .NET GateKeeper payload via finger.exe LOLBin for non-domain-joined targets.

Once a corporate foothold is profiled, KongTuke sells access to ransomware affiliates. Linked ransomware groups include Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta. The access broker is known to rotate across at least five Microsoft 365 tenants over 45-day periods and operates C2 through a mix of hardcoded IPs/domains and daily-rotating DGA domains.

MITRE ATT&CK techniques used in TL-2026-0967

Credential Access

T1003 OS Credential Dumping; T1056 Input Capture

Collection

T1005 Data from Local System; T1113 Screen Capture; T1119 Automated Collection

Command and Control

T1008 Fallback Channels; T1071 Application Layer Protocol; T1104 Multi-Stage Channels; T1132 Data Encoding; T1568 Dynamic Resolution; T1573 Encrypted Channel

Discovery

T1012 Query Registry; T1016 System Network Configuration Discovery; T1033 System Owner/User Discovery; T1049 System Network Connections Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1087 Account Discovery; T1135 Network Share Discovery; T1518 Software Discovery

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1497 Virtualization/Sandbox Evasion; T1574 Hijack Execution Flow

Exfiltration

T1041 Exfiltration Over C2 Channel

Persistence

T1053 Scheduled Task/Job; T1547 Boot or Logon Autostart Execution

Privilege Escalation

T1053 Scheduled Task/Job

Execution

T1059 Command and Scripting Interpreter; T1204 User Execution

Initial Access

T1189 Drive-by Compromise; T1199 Trusted Relationship; T1566 Phishing

Impact

T1486 Data Encrypted for Impact

stealth

T1574 Hijack Execution Flow

Resource Development

T1583 Acquire Infrastructure; T1584 Compromise Infrastructure; T1587 Develop Capabilities

Reconnaissance

T1589 Gather Victim Identity Information; T1592 Gather Victim Host Information

Affected products and versions in Mistic Self-Destructing In-Memory Backdoor (MLTBackdoor)

  • Microsoft — Windows
    Vulnerable versions: Windows 10; Windows 11; Windows Server 2019; Windows Server 2022
  • Google — Chrome
    Vulnerable versions: All versions supporting extensions
  • Microsoft — Microsoft Teams
    Vulnerable versions: All versions allowing external tenant communications

Remediation for Mistic Self-Destructing In-Memory Backdoor (MLTBackdoor)

Immediate actions

  • Block all listed C2 IPs and domains at perimeter firewall and DNS sinkholes: 142.93.242.144, 144.31.53.78, 198.13.159.44, 199.91.221.42, 144.172.99.68, 45.61.136.94, 64.95.12.238, 162.33.179.149, 64.95.13.76, 64.95.10.14, 170.168.103.208, 158.247.252.178, 199.217.98.108
  • Block DGA domains: carrolc.com, thomphon.com, powwowski.com, authorized-logins.net, sql-updater-service.com, upd-domain-goloro.com, updater-worelos.com, upscale-kolo.com, grande-luna.top, human-check.top, nexsnield.com, rs2y15sungu.com
  • Remove NexShield Chrome extension (ID: cpcdkmjddocikjdkbbeiaafnpdbdafmi) from all endpoints via enterprise browser management
  • Hunt for MpExtMs.exe executing outside %ProgramFiles%\Windows Defender\
  • Hunt for EndpointDlp.dll and version.dll in non-standard paths
  • Hunt for WPy64-31401 portable Python under %APPDATA%\Roaming\ on all endpoints
  • Disable external Microsoft Teams communications from unverified tenants (block *.onmicrosoft.com external senders outside known partners)
  • Alert on outbound TLS to /api/v1/telemetry with User-Agent: Microsoft-Delivery-Optimization/10.1 from non-Windows-Update processes

Workarounds

  • Block PowerShell execution via Windows Run dialog through AppLocker or GPO
  • Restrict RunMRU registry key to limit clipboard-paste attack surface
  • Configure browser enterprise policies to prevent sideloading of unpacked extensions and block extension installation except from approved list
  • Block outbound connections from pythonw.exe via host-based firewall rules
  • Monitor and restrict creation of scheduled tasks with /ru SYSTEM from non-admin user sessions

Longer-term hardening

  • Deploy behavioral EDR rules to alert on DLL sideloading from signed Microsoft binaries in non-standard directories
  • Implement application control (AppLocker/WDAC) blocking portable Python interpreters from %APPDATA% paths
  • Enable Microsoft Teams external access restrictions — require explicit tenant allowlisting for external communications
  • Implement DNS-layer filtering and TLS inspection to detect DGA patterns (.top domains, algorithmically generated .com domains)
  • Deploy YARA rules from RussianPanda95 repository: gatekeeper_payload.yar, MintsLoader.yar, ModeloRAT.yar
  • Implement network monitoring for HTTP beacon patterns to /beacon/{client_id} and /api/v1/telemetry paths
  • Restrict scheduled task creation to admin accounts via Group Policy; alert on SYSTEM-level task creation from user context
  • Block finger.exe from executing when not required; alert on finger.exe binary copy operations to %TEMP%

Weaknesses (CWE) in Mistic Self-Destructing In-Memory Backdoor (MLTBackdoor)

CWE-506, CWE-494, CWE-311, CWE-506

Timeline of Mistic Self-Destructing In-Memory Backdoor (MLTBackdoor)

  • KongTuke (Woodgnat/TAG-124) first observed as an active initial access broker, establishing durable enterprise footholds for sale to ransomware affiliates. Early campaigns used 404 TDS traffic distribution and ClickFix lures.
  • NexShield Chrome extension (ID: cpcdkmjddocikjdkbbeiaafnpdbdafmi, version 2025.1116.1842) observed active in Chrome Web Store as part of the CrashFix campaign. Extension deliberately crashes Chrome to social-engineer victims into running payload-delivery commands.
  • Symantec Threat Hunter Team first observes Mistic (Backdoor.Mistic) deployed in corporate intrusions alongside ModeloRAT. DLL sideloading via MpExtMs.exe and EndpointDlp.dll masquerading as Microsoft Endpoint DLP tooling is the delivery mechanism.
  • MLTBackdoor DGA domain rs2y15sungu.com used for payload distribution — the date-seeded LCG DGA generated this domain for April 29, 2026. Zscaler ThreatLabz pivots from this domain to map the full DGA algorithm and infrastructure.
  • Zscaler ThreatLabz begins internal tracking of the backdoor as MLTBackdoor, named after the 0x014D4C54 magic bytes ('\x01MLT') found in every C2 packet header. Technical reverse engineering of the obfuscation (MBA, CFF, DJB2 API hashing, Hell's Gate indirect syscalls) is completed.
  • Evidence of KongTuke-sold access being leveraged by at least six distinct ransomware groups confirmed: Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta. Intrusions across insurance, education, IT services, and professional services sectors in North America and Europe.
  • Community YARA rules released by RussianPanda95 covering GateKeeper .NET payload, MintsLoader, and ModeloRAT (github.com/RussianPanda95/Yara-Rules/tree/main/KongTuke). Full Python DGA implementation published by Zscaler enabling daily domain pre-computation for blocking.
  • Coordinated public disclosure by Symantec/Broadcom (Backdoor.Mistic protection bulletin) and Zscaler ThreatLabz (Technical Analysis of MLTBackdoor blog). ReliaQuest, Huntress, BleepingComputer, The Register, The Hacker News, and Security Affairs simultaneously publish coverage. Zscaler releases a DGA seed calculator and YARA rules on GitHub.

Sources cited for Mistic Self-Destructing In-Memory Backdoor (MLTBackdoor)

Threats related to Mistic Self-Destructing In-Memory Backdoor (MLTBackdoor)

Detection coverage for TL-2026-0967

As of 2026-06-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0967 across Splunk SPL, Microsoft KQL and Sigma, covering 46 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-0967

6 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats